A controller must not conduct processing that presents a heightened risk of harm to a consumer without conducting and documenting a data protection assessment of each such processing activity involving personal data acquired on or after the effective date (paragraph (9) before the 2026 renumbering). Heightened risk includes (166.12(c)) targeted advertising; profiling with a reasonably foreseeable risk of unfair or deceptive treatment or unlawful disparate impact, financial or physical injury, offensive intrusion upon seclusion or private affairs, or other substantial injury; selling personal data; and processing sensitive data. One assessment may cover a comparable set of similar processing operations (166.12(d)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.